Railway Investigation Report R07C0040

On 22 April 2007 at 0300 mountain daylight time, Canadian Pacific Railway freight train 375-237 collided with Canadian Pacific Railway freight train 862-012, derailing five loaded coal cars, two loaded grain cars, and three locomotives at Mile 42.55 on the Taber Subdivision. The crew from train 375-237 sustained minor injuries.

Ce rapport est également disponible en français.

After completing the required brake tests at 0120^{Footnote 1} on 22 April 2007, westbound Canadian Pacific Railway (CPR) freight train 375-237 (train 375) departed Dunmore, Alberta, Mile 138.8 on the Maple Creek Subdivision, destined for Lethbridge, Alberta, Mile 116.4 on the Taber Subdivision (see Figure 1). Train 375 consisted of 3 locomotives and 100 loaded grain cars; it was 5955 feet long and weighed 13 800 tons.

Image

The operating crew, a locomotive engineer and a conductor, met fitness and rest standards, were qualified for their respective positions, and were familiar with the territory. The crew had arrived in Medicine Hat at 1220 on 21 April 2007 and booked eight hours off. They were called for duty at 2300. The locomotive engineer slept for 8 ½ hours and the conductor slept for 6 ½ hours.

The trip from Dunmore to Bow Island, Mile 41.4 on the Taber Subdivision, was uneventful. At Bow Island, train 375 was to prepare for a meet with eastbound coal train 862-012 (train 862).

Train 375 had been issued a clearance giving permission to occupy the main track up to the west siding switch at Bow Island (Mile 42.55), where they were to wait until train 862 had arrived and cleared in the siding. Before departing Bow Island, they were to set the west siding switch to normal.^{Footnote 2} Eastbound train 862 had the authority to proceed to the west switch at Bow Island and take the siding with permission to leave the siding west switch in reverse position.

While approaching Bow Island, the crew of train 375 radioed train 862, which was waiting on the main track west of the west switch, and advised them that they could begin to proceed into the siding. Train 862 entered the west end of Bow Island siding and continued eastward along the siding at approximately 12 mph. Train 375 continued westward along the main track past the east siding switch and approached the crossing at Mile 42.0. Believing that the crossing was about halfway between the siding switches, the locomotive engineer began braking just west of the crossing. As train 375 rounded the left-hand curve approaching the west siding switch, the crew observed that train 862 was still entering the siding and the locomotive engineer placed the train into emergency. Train 375 was unable to stop and consequently struck the side of train 862, derailing five loaded coal cars as well as all locomotives of train 375 and its first two cars. The lead locomotive came to rest at Mile 42.55.

At the time of the derailment, the temperature was approximately 0°C and the wind was from the north at 7 km/h.

Train 862 had departed Lethbridge, Alberta, destined for Dunmore on 22 April 2007, just after midnight. It comprised 123 loaded coal cars, weighed 16 935 tons and was 6750 feet long. The operating crew, a locomotive engineer and a conductor, met fitness and rest standards, were qualified for their respective positions, and were familiar with the territory.

Site examination

The five derailed coal cars of train 862 came to rest south of, and parallel to, the siding track east of the west siding switch; the first and fifth cars remained upright, while the other three cars rolled onto their sides and spilled their product (see Figure 2).

Image

The lead locomotive of train 375 came to rest approximately 30 feet north of the main track near the west siding switch; the two following locomotives and first two cars also derailed to the north side. The third locomotive was immediately behind the second locomotive while the first had been pushed north. All three locomotives were leaning and had sustained heavy damage. The first derailed grain car had overturned and spilled its product; the second car remained upright.

The main track and the siding track, east of the west siding switch, were damaged for a distance of approximately 400 feet. An inspection of the track and the derailed equipment did not reveal any pre-derailment defects.

Recorded information

A review of the locomotive event recorder data from train 375 revealed the following:

• The train passed Mile 40.9 (the Bow Island east siding switch) while travelling in throttle 4 at 37 mph with no brake applied.
• The train continued westward with the speed varying between 35 mph and 37 mph and the throttle at times being increased to position 8.
• The train travelled over the crossing at Mile 42.00 at a speed of 36 mph.
• The brake pipe pressure was reduced by 13 pounds per square inch (psi) between Mile 42.09 and Mile 42.27.
• The throttle was moved to idle and the dynamic brake (DB) was engaged at Mile 42.17.
• The train was placed into emergency at Mile 42.307, approximately 1300 feet east of the west siding switch.
• The train experienced a sudden deceleration at Mile 42.508 while travelling at 21 mph.
• The horn and whistle were sounded as the train approached and passed over the crossings at Miles 40.2, 40.4, 40.8, and 42.0.

Communications between the trains

As train 375 approached train 862, the conductor from train 375 broadcast the restriction requiring train 375 to stop at the west siding switch at Bow Island. A personal conversation ensued between the conductor of train 375 and the locomotive engineer of the passing train (number 862). After the communication was complete, the conductor prepared to detrain and set the west switch to normal.

Rule 90 of CPR's publication of the Transport Canada (TC) Canadian Rail Operating Rules (CROR), effective 01 March 2002, Communication between Crew Members, requires crew members of a train to broadcast over the standby radio channel upcoming clearance restrictions one to three miles in advance of the restriction. Rule 122, Content of Radio Communications, requires radio communications to be brief and to the point and contain only essential instructions or information.

CPR's CROR number 106 states that "the conductor and the locomotive engineer are responsible for the safe operation of the train" and that if the train is operated in an unsafe manner, the conductor must "take action to comply with the applicable rules so as to ensure the safety of the train, including stopping the movement with an emergency brake application."

Track information

The Taber Subdivision extends from Bellcott, Alberta (Mile 1.4) to Lethbridge yard (Mile 116.4). In the area of the derailment, train movements were governed by the Occupancy Control System (OCS) as authorized by the Canadian Rail Operating Rules and were supervised by a rail traffic controller located in Calgary. There is no supplementary signal system on this territory. The track was classified as Class 3 track according to the TC Railway Track Safety Rules (TSR). The maximum authorized timetable speed for Class 3 track was 40 mph for freight trains. The maximum authorized timetable speed in the siding was 10 mph.

The track through the derailment area consisted of single main track in a horizontal curve, generally oriented in an east-west direction. Bow Island siding is south of the main track and extends between Mile 40.90 and Mile 42.55. It has a capacity of 7925 feet. The track gradient between the siding switches is a slight downgrade to the west.

Braking Loaded Bulk Commodity Trains at the West Siding Switch at Bow Island

A number of locomotive engineers with experience on the Taber Subdivision were canvassed to establish the method that they used to safely control long heavy westbound trains in preparation to stop at the west siding switch at Bow Island. The following describes the method:

• Approach the east switch at a speed not exceeding 40 mph with the DB applied (train bunched).
• Just past the east switch, initiate a minimum reduction automatic brake application.
• Supplement with more DB, and/or additional automatic brake.
• Travel over the crossing at Mile 42.0 at no more than 25 mph.
• Bring the train to a stop using additional DB if required.

Loaded unit bulk commodity trains (usually carrying coal, potash, grain, or sulphur) are known to have very high overall mass and a commensurately high "tons per operative brake" value. Extra precaution is required when handling these trains. When approaching any location of known restriction, it is essential to begin braking well in advance.

Proficiency testing

CPR conducts proficiency tests to ensure their operating crews are operating in accordance with company and regulatory rules and guidelines. Proficiency tests can involve a qualified supervisor riding along with the crew in the cab of the locomotive observing their method of operation. They can also be performed from remote locations and can involve such tasks as visual observation of crew performance and monitoring of railway radio broadcasts for compliance with approved radio procedures. If deficiencies are noted, remedial action is taken. During the previous 12 months, train 375's locomotive engineer had been tested 11 times; 3 times while operating as a locomotive engineer and 8 times while operating as a conductor. While operating as a locomotive engineer, deficiencies were noted during one of the tests, which dealt with CROR Rule 121, Positive Identification, during radio communications. The action was corrected and the employee advised. During the previous 12 months, the conductor was tested 16 times—all while operating as a conductor. Of the 16 tests, deficiencies were noted during 3 of the tests. The 3 tests dealt with CROR Rule 83, Operating Bulletins, and CROR Rule 110, Inspecting Passing Trains. Each time, he was provided with verbal coaching.

Factors affecting crew performance

Alertness

Alertness dramatically changes with the time of day.^{Footnote 3} Alertness cycles closely follow the body temperature cycle, with peak alertness occurring when body temperature is the highest (near midday) and low alertness occurring when body temperature is lowest (between 0300 and 0500). The time of day that a person works has a far greater effect on alertness than the number of consecutive hours worked. People can work extended hours over a number of days and maintain high levels of alertness and performance, as long as those work hours are between 0700 and 2300 in their normal cycle. During nighttime hours and, to a lesser extent, during the mid-afternoon dip, most types of human performance, whether manual dexterity, mental arithmetic, reaction time, or cognitive reasoning, are significantly impaired.

Fatigue

An analysis of the locomotive engineer's work/rest cycle was performed to establish the possible effect of fatigue. Although the locomotive engineer had accumulated a sleep debt, it is unlikely that the degree of the resultant fatigue significantly reduced his ability to safely operate the train.

Use of short half-life serotonin reuptake inhibitors

According to medical sources, around 5 to 10 per cent of Canadian adults are being treated for depression at any one time, suggesting that a similar percentage applies to railway employees in safety critical positions. If patient treatment is monitored and managed correctly, studies^{Footnote 4} have shown that employees in safety critical positions can continue to work safely while being treated. However, if the treatment is not consistently adhered to, this condition and the related medications could potentially affect the ability of operating employees to function safely.

Paroxetine is a short half-life^{Footnote 5} serotonin reuptake inhibitor (SSRI) commonly prescribed for the treatment of depression and other disorders. The locomotive engineer had been taking Paroxetine for anxiety for several years; however, he did not take this medication when working and away from home. Taking into account his recent work history and habits, he probably did not take his medication on 19 and 21 April 2007.

Missed doses undermine the effectiveness of the drug in treating the mood disorder. In addition, Paroxetine has among the highest incidence rates and severity of withdrawal syndrome of any SSRI^{Footnote 6}. Medical literature^{Footnote 7} has documented multiple adverse effects within two days of withdrawal from Paroxetine. Some described symptoms that could affect a locomotive engineer's ability to perform include dizziness, nausea, tiredness or fatigue, difficulty concentrating, trouble sleeping, and feeling agitated. It is not known whether any of these symptoms would be likely to occur if the medication was taken sporadically or cessation was for less than 48 hours.

The aviation industry is carrying out a controlled treatment program using SSRIs for pilots with depressive disorders. Extensive psychiatric and psychological testing is being used to ensure that performance in the cockpit is not affected. This includes selection of appropriate SSRIs to minimize the risk of side effects^{Footnote 8}. However, Paroxetine would not normally be given to air crews because of the potential for adverse effects. Management of the risks of SSRI prescription is handled centrally by Transport Canada head office medical staff. This is different to the rail industry, where treatment advice is made available to medical practitioners at large.

The Canadian Railway Medical Rules Handbook provides some guidance concerning the treatment of mood disorders in general and specifically the prescription of SSRIs (though Paroxetine is not mentioned). However, the guidelines do not explicitly describe the potential side effects nor the effects of withdrawal, though they do state "…side effect profiles can be idiosyncratic. Any individual who is being treated with one of these anti-depressants must be closely followed by a physician."

The Canadian Railway Operating Rules place the onus on employees to "know and understand the possible effects of drugs, medication, or mood altering agents, including those prescribed by a doctor" and not to work if their ability to work safely is adversely affected.

Situational awareness

Maintaining an accurate mental model—that is, maintaining situational awareness—is paramount to ensuring safe operations. Situational awareness develops on three different levels.

First, the person must perceive the situational elements from information displays, communications, or from viewing the scene. The person then integrates the information into a mental model by using his or her experience and knowledge. Finally, the person projects the information into the future to make and modify plans as tasks are completed or delayed and new developments arise. Information processing, sensing, perception, memory, attention limitations, and workload all influence the individual's ability to maintain accurate situational awareness.

Attention limitations of the central decision maker restrict the number of stimuli humans are able to attend to. Normal limitations can be further exacerbated by such factors as the operating environment, causing the individual to omit, mistime, misorder, forget, repeat, or commit the wrong action.

Authority gradient

Operator interactions may cause individuals to work for or against each other, or to fail to use all available resources. The existence of an authority gradient is one factor that can adversely affect operator interactions. An authority gradient can occur when there is either a real or perceived imbalance of decision-making power in a given situation. For example, crews or teams that have an overbearing team leader can experience a steep authority gradient. Other teams or crews comprised of both senior and junior employees may develop an authority gradient on the basis of perceived experience or knowledge. In such situations, expressing concerns, questioning, or clarifying instructions can require considerable effort on the part of individuals who believe that their input is perceived as unwanted. An authority gradient can result in unsafe situations remaining unchallenged.

Crew resource management

Crew resource management (CRM) programs encourage the respectful questioning of authority, with the primary goal being enhanced situational awareness. Appropriate communication techniques are required to be taught at all organizational levels so that supervisors understand that the questioning of authority is not a threat and so that subordinates learn the correct way to question the person with authority.^{Footnote 9}

The Board has previously identified a lack of information available to train crews for developing adequate situational awareness (TSB report R96Q0050). The TSB expressed concerns that there were no established CRM programs in use on railways to ensure that all persons involved are aware of the most up-to-date and accurate information concerning the movement of trains and engines. The report also expressed concerns that when specific methods of communications transmission and verification are not in place, there is a greater risk that a piece of information could be misinterpreted.

Report R07E0129 also dealt with the subject of in-cab communications and found that in the absence of procedures that recognize the risks inherent in an authority gradient, intra-cab communication can fail.

In report R08W0058, the Board identified in-cab communications as a causal factor in the accident and determined that when crew members do not adequately communicate and confirm understanding, there is an increased risk that miscommunications and perception errors will go undetected, potentially leading to train collisions.

Additionally, in report R98V0148, the Board determined that the current emphasis by airlines and aviation regulatory agencies on CRM training has created a substantial improvement in cockpit discipline and performance. The "trans-cockpit authority gradient" should be relatively flat as a result of CRM development. The marine industry has adopted bridge resource management training for ships' officers and a similar safety improvement in accidents or incidents attributed to communication irregularities was anticipated.

It was suggested that within the railway industry, crew pairing commonly comprised senior and junior crew members and, therefore, the importance of CRM training should be developed as a safety initiative to eliminate the "authority gradient" factor. Both CPR and VIA Rail Canada adopted this approach and have recurrent training in situational awareness and communications between crew members.

Positive train control

Positive Train Control (PTC) is a system for enforcing the limits of a train's operating authority by electronically monitoring and controlling train movements and thus providing increased safety. Train positions are tracked automatically via a wireless data link. PTC's software uses real time information to enable controllers to more effectively and safely control on-track activities. The train's onboard computer monitors the data against actual train location and speed to determine potential and actual unsafe conditions. If a train is approaching the end of its limits or is nearing its speed limit, an onboard computer can warn the locomotive engineer. If a train nears the end of its limits and the locomotive engineer has not taken action to bring the train under control, the onboard computer automatically initiates a safety brake application to bring the train to a controlled stop. Similarly, if a train exceeds its allowable speed limit, the brakes are applied to slow the train.

PTC systems are currently under development and prototypes are in limited use on several North American Class 1 railways. Moreover, Union Pacific Railway is planning to test a version of PTC on its lines in Iowa, Nebraska, Wyoming, Washington, and Idaho, United States (US). The technology is expected to be more fully deployed in North America within five years. The US Congress has legislated that all Class 1 freight railways and passenger operators develop a plan for implementation of PTC by 31 December 2015 on main tracks used by passenger services, as well as on tracks where freight trains carry dangerous goods designated as toxic by inhalation. The US National Transportation Safety Board (NTSB) has the adoption of PTC technology by the railways as an item on its "top ten" list of railroad safety improvements.

The TSB investigated a main-track collision which occurred on 07 April 2008 at Mile 97.5 of the Weyburn Subdivision at Centennial Station near Ralph, Saskatchewan (TSB occurrence number PTCR08W0058PTC). CPR freight train 498-07 struck the tail end of stationary CPR train 292-05. Seven cars on train 292-05 derailed and two cars on train 498-07 derailed. In addition, two cars on CPR freight train 497-04, which had stopped adjacent to train 292-05 in Centennial Siding, derailed. A fire ensued involving two loaded cars containing glycol, one dangerous goods car containing vinyl acetate, one residue liquefied petroleum gas tank car, and one empty bulkhead flat car. Local residents within a one-mile radius of the accident were evacuated. The Board concluded that "PTC has the potential to significantly reduce collisions between trains".

There were no deficiencies identified with either the rolling stock or the track. The analysis will focus on the actions of the crew.

A review of the data from the locomotive event recorder shows that the train travelled over the crossing at 37 mph with the brakes released and that braking did not begin until the train had travelled about three-quarters of the length of the siding. This left only about 2165 feet in which to stop the train. The train was then quickly placed into emergency, but it had only slowed to 21 mph before the impact.

Other locomotive engineers would typically use the entire length of the siding to slow and stop a loaded bulk commodity train at this location. With the slack bunched from the use of DB, and the air brakes throughout the train conditioned by the application of a minimum reduction automatic brake application, the train would be under control. The interim goal of travelling over the crossing at Mile 42.0 at no more than 25 mph would have ensured that the train could be brought to a stop in advance of the west siding switch.

The locomotive engineer was trained on and experienced in handling long heavy trains and was aware of the location of the west siding switch. Moreover, there was nothing exceptional about this section of track that would have made a stop particularly difficult. However, the occurrence train was not operated in a manner consistent with the safe train handling methods typically followed at this location. Because the train was braked too late, it could not be stopped safely prior to the west siding switch and, consequently, its lead locomotive struck the tail end portion of eastbound train 862 as it was clearing the main track.

Unlike the Canadian air industry, which manages the risks of SSRI prescription centrally, the rail industry provides advice on the treatment of mood disorders and the use of SSRIs to the medical community at large. While Paroxetine is not normally prescribed for use by aircrew because of the potential of adverse effects, this specific SSRI is not mentioned in the Canadian Railway Medical Rules Handbook

It is known that abrupt cessation of Paroxetine can result in negative withdrawal symptoms as early as the second missed dose. If present, these symptoms can negatively impair the ability to carry out key mental tasks, including receiving and processing information from multiple sources, maintaining situational awareness, remaining alert, and solving problems with little or no room for error in a rules-based environment.

The locomotive engineer's use of Paroxetine was sporadic; however, he likely did not miss two doses in a row in the days leading up to the accident. It could not be determined whether any of the documented withdrawal symptoms affected the locomotive engineer's performance. Railway employees in safety critical positions who have been prescribed SSRIs and are not advised of their withdrawal effects, or do not otherwise understand them, represent a risk to safety should they not follow the required dosage schedule.

There was no information to suggest that an authority gradient existed between the crew members of train 375 that would have discouraged open communication. Both employees were experienced and both were familiar with the territory. The CROR places the responsibility for ensuring that the train is being operated in a safe manner on both the locomotive engineer and the conductor. To fulfill these responsibilities, the conductor must monitor the activities of the locomotive engineer and remain alert and vigilant throughout the entire journey, especially when the locomotive engineer is performing operations that present an elevated level of risk, such as during a meet with an opposing train. Although the conductor did broadcast the meet from the cab to the crew of the opposing train, he was also occupied in a non-work-related conversation with the locomotive engineer of that train. The conductor did not remain alert to the actions of the locomotive engineer, did not remind him of the requirement to stop at the west siding switch, and did not take independent action to stop the train.

Strategies to encourage open lines of communication among crew members, such as well-developed CRM practices, are one way to address the problem of inadequate communication. Elements of CRM have been incorporated into railway operating philosophy and some efforts have been made to provide training on this subject. However, in this occurrence, the CRM was inadequate and did not ensure that the necessary intra-cab communication occurred and that the train stopped safely at the west siding switch at Bow Island.

The locomotive engineer was aware of the requirement to stop the train and set the west siding switch to normal, yet he operated as if he was anticipating that the track would be clear and the switch would be restored to the normal position, permitting the through movement of his train on the main track. He took actions prior to arrival at Bow Island that would indicate a degree of alertness. However, the accident took place during a time of day when a person's circadian rhythm is known to be at a low point. When a person's circadian rhythm is low, they are more susceptible to performance-related errors.

A number of factors are known to adversely affect an individual's ability to maintain accurate situational awareness, one of which is distraction. The conductor was engaged in a non-work-related conversation with a crew member on another train at the most safety critical time—when the locomotive engineer was formulating and executing his train control plan.

Although not fatigued to the extent likely to adversely affect performance, it is possible that the locomotive engineer was distracted at a time of day when he was more prone to performance-related errors, leading to a temporary loss of situational awareness and the formulation and execution of an unsafe train-handling plan.

Because not all aspects of train operations are automated, the railway relies on the crew to perform safety critical manoeuvres in a predictable manner. To ensure that the crews properly perform their tasks, the railway trains, monitors, and evaluates its crews to ensure that they are compliant with the rules. Moreover, back-up, or redundant, procedures are often put in place to help ensure that lapses or errors in human performance do not go unnoticed, leading to accidents. In this case, having both crew members responsible for the safe operation of the train provided a level of redundancy and the railway conducted proficiency testing to ensure that rules were followed. However, these administrative barriers did not prevent the collision from occurring. Because human actions are not always predictable, administrative defensive barriers that rely solely on crew members to properly perform their tasks are not the most effective method to control risks.

On the Taber Subdivision, the train control system (OCS "dark territory") is reliant on administrative defences that are susceptible to human error. Emerging technologies can help railways better automate train operations and lower the risks associated with human error. One such example is PTC. PTC is a significant advance in train control in which the system defences can alert crews to impending points of restriction and even intervene to stop a train if action is not taken. However, as this is an emerging technology, its implementation on low-traffic density territory is not likely to take place in the near future. In the absence of enhanced defences, the train control system (OCS "dark territory") does not provide adequate redundancy to always prevent this type of accident.

Findings as to causes and contributing factors

1. Because the train was braked too late, it could not be stopped safely prior to the west siding switch and, consequently, its lead locomotive struck the tail-end portion of eastbound train 862 as it was clearing the main track.
2. The occurrence train was not operated in a manner consistent with the safe train-handling methods typically followed at this location.
3. In this occurrence, crew resource management was inadequate in preventing the collision. The conductor did not remain alert to the actions of the locomotive engineer, did not remind him of the requirement to stop at the west siding switch, and did not take independent action to stop the train.
4. Although not fatigued to the extent likely to significantly reduce his ability to safely operate the train, it is possible that the locomotive engineer was distracted at a time of day when he was more prone to performance-related errors, leading to a temporary loss of situational awareness and the formulation and execution of an unsafe train-handling plan.

Findings as to risk

1. Because human actions are not always predictable, there is a risk that administrative defence barriers that rely solely on crew members to properly perform their tasks will fail.
2. In the absence of enhanced defences, there is a risk that the train control system (Occupancy Control System "dark territory") will not provide adequate redundancy to always prevent this type of accident.
3. The Canadian Railway Medical Rules Handbook may not adequately address the risks associated with the use of short half-life serotonin reuptake inhibitors (and specifically Paroxetine), their potential side effects, and associated withdrawal symptoms.
4. Railway employees in safety critical positions who have been prescribed short half-life serotonin reuptake inhibitors and are not advised of their withdrawal effects, or do not otherwise understand them, represent a risk to safety should they not follow the required dosage schedule.

Immediately following the accident, Canadian Pacific Railway's managers, Health and Safety Committee members and union leaders conducted a 72-hour blitz of the terminal. In addition, the following steps were taken:

• The number of proficiency tests in the area of the incident was increased.
• The number of train rides with the requirement to stop at the accident area was increased.
• Two safety blitzes were conducted.
• There was an increased focus on random locomotive event recorder downloads aimed at ensuring compliance with train-handling rules.
• A train crew evaluation was performed in 2007 and 2008 on all active employees.
• The events surrounding the collision, crew resource management tools, and situational awareness was reviewed during the rollout of the new 2008 Canadian Rail Operating Rules handbook.

The Canadian rail industry has reviewed the use of anti-depression medications by employees in safety critical positions and has provided the findings to the Federal Railroad Adminsitration in the United States.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 05 August 2009.